Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-67327 — better-auth

Fix: better-auth/better-auth#10239

CVE-2026-67327 is a Improper Authentication vulnerability in better-auth. A fix is available for better-auth — see the affected versions and patch details below.

better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

Also known asGHSA-qq9h-g4jm-xgf3
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 14, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-67327.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs36th percentile — riskier than 36% of all scored CVEsHighest risk
0.00%0.31%0.62%0.93%0.4%0.4%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

854other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
better-authnpm
11.9Mdownloads / week

Description

Am I affected

You are affected if all of the following hold:

  • You run a better-auth version below 1.6.22, or a 1.7.0-beta below 1.7.0-beta.10.
  • You enable the magic-link plugin or the email-OTP plugin.
  • You also enable email and password sign-up with open registration.
  • An account can exist at an address before its owner first signs in with the passwordless flow.

Summary

An attacker can keep password access to a victim's account after the victim starts using it. The attack runs in three steps. First, with open registration, the attacker signs up using the victim's email and a password the attacker picks. The account stays unverified, so the attacker cannot use it yet. Later the real owner signs in with a magic link or an email OTP. That step marks the account verified, and the attacker's password now works on it.

Details

When an account already exists for an address, magic-link verification and email-OTP sign-in both sign in to that account. They mark it verified and issue a session. Before the fix, neither one removed a password set while the account was still unverified. Neither one revoked existing sessions. So a password set before anyone proved control of the mailbox kept working after the owner proved control.

This is a pre-account-hijacking weakness. It is the same class as the OAuth advisory GHSA-g38m-r43w-p2q7, applied to the passwordless email flows. Requiring email verification does not stop it. The verification step is the exact moment that turns the planted account into a usable one.

The fix treats current proof of control over the address as authoritative. When either flow finds an account whose email was never confirmed, it now removes the password and revokes existing sessions first. Only then does it mark the account verified and issue the new session. The owner signs in as before. Only access created before the proof is removed.

Patches

Upgrade to better-auth 1.6.22 or later on the stable line. On the 1.7 pre-release line, upgrade to 1.7.0-beta.10 or later. Earlier 1.7 betas, up to and including 1.7.0-beta.9, still contain the bug.

Workarounds

If you cannot upgrade right away, you can lower the risk in two ways. Require email verification before you accept any password on an account. Remove unverified accounts quickly, so an address cannot sit reserved for long. Both steps shrink the opening, but they do not close it. Upgrading is the real fix.

Impact

The attacker gains lasting password access to an account the victim depends on, alongside the victim. From there the attacker can read and change the victim's data. The attacker can also reset the credentials and lock the victim out. The takeover only completes when the victim signs in through the passwordless flow. It also needs a setup that pairs that flow with open email and password sign-up.

Credit

Reported by the Vercel security team.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmbetter-auth≥ 1.1.3&&< 1.6.221.6.22npm install better-auth@1.6.22
📦npmbetter-auth≥ 1.7.0-beta.0&&< 1.7.0-beta.101.7.0-beta.10npm install better-auth@1.7.0-beta.10

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for better-auth, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update better-auth to 1.6.22 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-67327 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

### Am I affected You are affected if all of the following hold: - You run a `better-auth` version below 1.6.22, or a `1.7.0-beta` below `1.7.0-beta.10`. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist at an address before its owner first signs in with the passwordless flow. ### Summary An attacker can keep password access to a victim's account after the victim starts using it. The attack runs in three steps. First, with open registration, the attacker signs up using the victim's email a
O3 Security · Impact-Aware SCA

Is CVE-2026-67327 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-67327: better-auth — Fixed in 1.6.22